pxe_boot_alma/homelab/docs/alma9-to-alma10-breaking-changes.md

AlmaLinux 9 → AlmaLinux 10 Breaking Changes

Generated: 2026-03-24 Scope: Hard-removed features, non-overridable crypto changes, dropped packages — relevant to server/security/infrastructure workloads. Upstream: AlmaLinux 10 tracks RHEL 10 (kernel 6.12, released May 2025).

---

1. Cryptography — Hard Removals (no workaround)

SHA-1

Scenario	RHEL 9	RHEL 10
SHA-1 in TLS	Disabled in DEFAULT; re-enable via DEFAULT:SHA1 subpolicy	Hard removed from TLS — LEGACY policy does NOT re-enable it in TLS. Must override per-app via OpenSSL cipher string with SECLEVEL=0.
SHA-1 in NSS/GnuTLS (non-TLS)	Policy-gated	Hard at library level — NSS and GnuTLS reject SHA-1 regardless of crypto-policy setting
SHA-1 in OpenSSL (non-TLS)	Re-enable via DEFAULT:SHA1 subpolicy	Soft — re-enable via LEGACY policy only
DEFAULT:SHA1 subpolicy	Exists	Hard removed — the subpolicy definition is gone entirely

DSA

• NSS: DSA is hard-compiled out of the NSS library. No policy toggle. Affects anything using NSS (curl-NSS builds, certutil, etc.).
• OpenSSL: DSA available in LEGACY (soft).
• GnuTLS: Deprecated, hard removal expected in a future 10.x minor.

Other Hard Crypto Removals

Item	Notes
SEED algorithm	Hard-removed from NSS
SRP (Secure Remote Password) in TLS	Hard-removed from GnuTLS; was incompatible with TLS 1.3 + relied on CBC+SHA-1
TLS HeartBeat extension	Hard-removed from OpenSSL (attack surface reduction post-Heartbleed)
MIT Kerberos RSA PKINIT method	Hard-removed from krb5 as Marvin attack mitigation; must use ECDH-based PKINIT
openssl-pkcs11 ENGINE bridge	Package removed; replaced by pkcs11-provider (new OpenSSL provider API)

FIPS Mode Operational Changes

• /etc/system-fips file removed as FIPS indicator.
• fips-mode-setup command removed. FIPS is boot-time only via fips=1 kernel parameter. No runtime switching.

---

2. Cryptography — Soft Changes (re-enable via LEGACY policy or config)

Item	How to re-enable
TLS 1.0 / TLS 1.1	update-crypto-policies --set LEGACY
3DES, RC4, DES	update-crypto-policies --set LEGACY
RSA key-exchange TLS cipher suites (non-PFS)	update-crypto-policies --set LEGACY
RSA keys < 2048 bits (≥ 1024 allowed)	update-crypto-policies --set LEGACY
SHA-1 (OpenSSL, non-TLS)	update-crypto-policies --set LEGACY

---

3. Removed Packages

Networking

Package	Replacement
dhclient / dhcp client	NetworkManager built-in (dhcp=internal in connection profile)
teamd + libteam (network teaming)	Bonding (nmcli bond)
NetworkManager-initscripts-updown	N/A (depends on removed network-scripts)
ifcfg file format	Keyfile format (/etc/NetworkManager/system-connections/)
iptables, ip6tables, arptables, ebtables userspace tools	nftables / nft

Note: iptables kernel modules (xt_*, ip_tables, ip6_tables) are not shipped in the kernel. Only nf_tables is present. Docker/Moby iptables mode will fail.

Security / Auth

Package	Replacement
pam_console	systemd-logind (already the default in RHEL 9)
pam_ssh_agent_auth	No in-distro replacement
sssd-files (SSSD files provider)	SSSD proxy provider for local-user smart card / session recording paths
libsss_simpleifp.so / libsss_simpleifp	Removed (deprecated in RHEL 9)
fips-mode-setup command	fips=1 kernel parameter at install

SSSD Config Options Removed

• reconnection_retries
• ad_allow_remote_domain_local_groups (deprecated in RHEL 9.6)
• enumeration feature for AD/IdM providers

Identity Management

• IdM NIS functionality removed from Identity Management stack entirely.

Cockpit

• cockpit-composer replaced by cockpit-image-builder plugin.

---

4. Kernel Changes

cgroups v1 — Hard Removed

• cgroups v1 is gone from the RHEL 10 kernel (6.12). No boot parameter re-enables it.
• systemd.unified_cgroup_hierarchy=0 has no effect — v1 hierarchy does not exist.
• /sys/fs/cgroup/memory, /sys/fs/cgroup/cpuset, etc. will not exist.
• Impact: Any container runtime, application, or systemd drop-in that explicitly requests cgroup v1 will break. Container runtimes (Docker, containerd, Podman) must be configured for cgroup v2 only.

iptables Kernel Modules — Hard Removed

• xt_*, ip_tables, ip6_tables, arptable_filter, ebtables modules are not included in the kernel.
• Docker's default iptables networking mode fails at startup. Must configure Docker with "iptables": false and manage firewall rules via nftables, or use a Docker version with native nftables support.

Other Kernel Notes

• Frame pointers enabled by default in kernel and userspace (improves eBPF/perf tracing, ~1% overhead).
• No documented removals from the audit subsystem or seccomp BPF interface.

---

5. Authentication / PAM

Change	Type
pam_console removed	Hard — use systemd-logind
pam_ssh_agent_auth removed	Hard — no in-distro replacement
SSSD files provider removed	Hard — reconfigure to proxy provider
pam_tally/pam_tally2	Already gone in RHEL 8/9; use pam_faillock (unchanged)
authconfig	Already gone in RHEL 8/9; use authselect (unchanged)

---

6. Systemd

Change	Type
cgroups v1	Hard — systemd 256+ refuses to run under cgroup v1; v1 absent from kernel
SysV init script compatibility	Still present in 10.0; hard removal flagged as upcoming in systemd 259+

---

7. SELinux

• Policy updated to version 3.8.
• audit2allow outputs CIL format by default (instead of .te files). Update any scripts that parse audit2allow output.
• No policy module hard-removals documented for 10.0, but boolean/module names may differ after the version bump — verify with semodule -l post-migration.

---

8. Quick Reference: Hard vs Soft

Item	Hard	Soft
SHA-1 in TLS	✓
SHA-1 via NSS/GnuTLS (any context)	✓
DEFAULT:SHA1 subpolicy	✓
DSA in NSS	✓
SEED in NSS	✓
SRP in GnuTLS	✓
TLS HeartBeat (OpenSSL)	✓
MIT Kerberos RSA PKINIT	✓
openssl-pkcs11 ENGINE	✓ (replaced by pkcs11-provider)
fips-mode-setup command	✓
cgroups v1	✓
iptables kernel modules	✓
dhclient package	✓
Network teaming (teamd)	✓
ifcfg file format	✓
SSSD files provider	✓
pam_console	✓
pam_ssh_agent_auth	✓
IdM NIS	✓
TLS 1.0 / 1.1		✓ LEGACY policy
3DES / RC4 / DES		✓ LEGACY policy
RSA key-exchange TLS suites		✓ LEGACY policy
SHA-1 via OpenSSL (non-TLS)		✓ LEGACY policy
RSA keys 1024–2047 bits		✓ LEGACY policy
DSA via OpenSSL		✓ LEGACY policy

---

9. Application-Specific Clarifications

net-snmp / SNMPv3 SHA-1 Authentication

Not broken. SNMPv3 USM uses SHA-1 as an HMAC for message authentication, not as a signature algorithm. The RHEL 10 DEFAULT crypto policy (and the NO-SHA1 module) explicitly restricts SHA-1 only in signatures and certificate validation — HMAC-SHA1 remains permitted. From Red Hat's own documentation:

"The NO-SHA1 module disables the SHA-1 hash function only in signatures and not elsewhere. In particular, the NO-SHA1 module still allows the use of SHA-1 with HMAC. This is because HMAC security properties do not rely on the collision resistance of the corresponding hash function."

Additionally, the system-wide crypto policy framework only governs TLS, IPsec, DNSSEC, and Kerberos — not SNMPv3 USM, which is an application-layer protocol. Net-snmp links against OpenSSL (not NSS), and OpenSSL 3.5 on RHEL 10 does not block HMAC-SHA1 at the API level.

SHA-256 auth is available as SHA-256 in snmpd.conf createUser directives and via snmpwalk -a SHA-256. Net-snmp 5.9+ (shipped in RHEL 9/10) includes full RFC 7860 support: SHA-224, SHA-256, SHA-384, SHA-512.

Exception: Under FIPS mode, SHA-1 HMAC is also disallowed. Outside FIPS, SNMPv3 SHA-1 auth works normally on RHEL 10.

FreeIPA / Red Hat IdM

Standard FreeIPA deployments are largely unaffected by RHEL 10 changes. Detailed breakdown:

Change	FreeIPA Impact
MIT Kerberos RSA PKINIT removed	None — FreeIPA smart card PKINIT uses DH-based key agreement; RSA-envelope mode was not used
DSA removed from NSS	None — Dogtag CA uses RSA/ECDSA; DSA CA keys were never a supported install config
IdM NIS functionality removed	None for standard deployments — only affects sites actively serving ypserv-style NIS queries from FreeIPA (deprecated since RHEL 8.3). The cn=compat LDAP tree (legacy LDAP clients) is not removed.
SSSD files provider removed	None — FreeIPA clients use the ipa SSSD provider, not files
pam_ssh_agent_auth removed	None — not part of any FreeIPA authentication flow
TLS RSA key exchange removed from DEFAULT	None — FreeIPA and Dogtag already use ECDHE/DHE
RC4/3DES removed from Kerberos defaults	Handled automatically — FreeIPA 4.12.2 removes these enctypes itself on upgrade

One genuine operational change (not crypto): 389-ds is migrating from BerkeleyDB to LMDB in RHEL 10 (libdb is removed). ipa-server-upgrade handles the database migration automatically, but it should be tested in a lab before upgrading a production IPA server. Expect longer upgrade time proportional to directory size.

---

Sources

• RHEL 10.0 Release Notes — Removed features
• RHEL 10.0 Release Notes — Deprecated features
• Considerations in adopting RHEL 10 — Security
• RHEL 10 System-wide cryptographic policies
• AlmaLinux 10.0 Release Notes
• Considerations in adopting RHEL 10 — Identity Management
• NO-SHA1 subpolicy — RHEL crypto policies
• RFC 7860 — HMAC-SHA-2 Authentication Protocols in USM for SNMPv3
• FreeIPA 4.12.2 Release Notes